System File Formats — WhatThisFile

About system files

System files are the ones that make you nervous. Executables, installers, disk images, packages — these files can do things to your computer, which is why the safety rating matters more here than in any other category. The rule is simple: if you didn't ask for it, don't open it.

Every operating system has its own executable and installer format. Windows has EXE and MSI. macOS has DMG and PKG. Linux has DEB and RPM. Android has APK. iOS has IPA (though Apple doesn't let you sideload them). These formats exist because installing software requires system-level access — writing files, modifying settings, registering services — and each OS handles that access differently.

The safety spectrum in this category ranges from "probably fine" (a DMG from a developer's website) to "exercise extreme caution" (an EXE from an email attachment). Code signing, platform gatekeepers (Gatekeeper, SmartScreen, Play Protect), and antivirus scanning exist specifically because this category of files is where malware lives.

All system formats

.apk APK is Android's application package — a ZIP archive contain... .app An .app is not a file — it's a macOS folder disguised as a s... .AppImage AppImage is a portable Linux application format — one file, ... .bin BIN is a generic binary data file — it could be firmware, a ... .cue A cue sheet describes the track layout of a CD/DVD disc imag... .deb DEB is the package format for Debian-based Linux distributio... .dll DLL is a shared library for Windows — containing code and da... .dmg DMG is a macOS disk image used to distribute software — it m... .dylib Dylib is macOS's shared library format — the Mac equivalent ... .exe EXE is a Windows executable — compiled machine code that run... .flatpak Flatpak is a sandboxed, distro-independent Linux application... .img IMG is a raw sector-by-sector disk image — an exact copy of ... .ipa IPA is the iOS app package format — an encrypted ZIP archive... .iso ISO is a byte-for-byte disc image — a complete replica of a ... .msi MSI is a Windows installer package — containing everything n... .ova OVA is a complete virtual machine package — disk image, conf... .pkg PKG is the standard macOS installer format — distributing ap... .qcow2 QCOW2 is QEMU/KVM's native disk format — supporting snapshot... .reg REG files import or export Windows registry settings — text ... .rpm RPM is the package format for Red Hat-based Linux distributi... .snap Snap is Canonical's containerised Linux package format — sel... .so SO is Linux's shared library format — the equivalent of Wind... .sys SYS is a Windows kernel-mode driver file — low-level softwar... .vdi VDI is VirtualBox's native virtual hard disk format — a file... .vhd VHD is Microsoft's virtual disk format for Hyper-V — also mo... .vmdk VMDK is VMware's virtual hard disk format — a file that acts...

Safety notes

.apk Use caution

Sideloading APKs from outside the Play Store carries malware risk. Only install from trusted sources.

.app Use caution

Application bundles run code on your Mac. Only install apps from the App Store, identified developers, or sources you trust.

.AppImage Use caution

Runs code with your user permissions. No sandboxing. Only download AppImages from the developer's official site.

.bin Use caution

Generic binary — could contain anything. Firmware .bin files can modify hardware. Disc image .bin files are generally safe media data.

.deb Use caution

DEB packages install software with system-level access. Only install from trusted repositories.

.dll Use caution

DLL files contain executable code. Never download DLLs from untrusted websites — this is a common malware vector.

.dmg Use caution

DMG files can contain any software. Only open DMGs from trusted developers. macOS Gatekeeper will warn you about unsigned apps.

.dylib Use caution

Compiled binary code. System dylibs are protected by SIP. Only install dylibs from trusted sources.

.exe Potentially unsafe

EXE files can execute arbitrary code on your computer. Only run executables from trusted sources. Scan with antivirus before opening.

.flatpak Use caution

Application package. Sandboxed but still runs code. Install from Flathub or trusted sources.

.img Use caution

Disk images can contain any data including bootable operating systems. Writing to a USB drive overwrites all existing data on that drive.

.ipa Use caution

IPA files cannot be sideloaded on standard iOS devices. Enterprise or developer-signed IPAs from untrusted sources may compromise device security.

.iso Use caution

ISO files can contain any software. Only mount ISOs from trusted sources.

.msi Use caution

MSI files install software on your computer. Only install from trusted sources.

.ova Use caution

Contains a complete VM including an operating system and applications. Only import OVAs from trusted sources — they can contain any software.

.pkg Use caution

PKG files install software and can run scripts with elevated permissions. Only install from trusted developers.

.reg Use caution

REG files modify Windows system settings. Never run .reg files from untrusted sources. Always review contents in a text editor before importing.

.rpm Use caution

RPM packages install software with system-level access. Only install from trusted repositories.

.snap Use caution

Application package. Snaps are sandboxed but still run code. Install only from the official Snap Store or trusted sources.

.so Use caution

Compiled binary code. Only install shared libraries from trusted package repositories.

.sys Use caution

Kernel-mode driver with full system access. SYS files from untrusted sources can compromise your entire system.

FAQ

Is it safe to run an EXE file?

Only if you trust the source. EXE files can do anything your user account can do. Check for a valid code signature (right-click → Properties → Digital Signatures on Windows). If it's unsigned and from an unknown source, don't run it.

What's the difference between EXE and MSI?

Both install software on Windows. EXE is a generic executable that can do anything. MSI is a structured installer managed by the Windows Installer service — it supports clean uninstall, repair, and silent installation. MSI is generally considered safer because it follows a defined installation framework.

How do I install software from a DMG on Mac?

Double-click the DMG to mount it. Drag the application to your Applications folder. Eject the DMG. The app now lives in Applications — the DMG is just the delivery vehicle and can be deleted.

Related categories